A.GitHub

B.SplunkBase

C.www.splunk.com

D.The ES installation package

A.Create notable event

B.Create investigation

C.Create new asset

D.Create new correlation search

A.DA-

B.SA-

C.TA-

D.App-

A.src, dvc, dest

B.cidr, port, netbios, saml

C.ip, mac, dns, nt_host

D.host, hostname, url, address

A.Settings -> Searches, Reports, and Alerts -> Filter by Name of "Correlation"

B.Configure -> Content Management -> Select Type "Correlation" and Status "Enabled"

C.Configure -> Correlation Searches -> Select Status "Enabled"

D.Settings -> Searches, Reports, and Alerts -> Select App of "SplunkEnterpriseSecuritySuite" and filter by
"- Rule"